---
title: Private networking
description: Reach other services in the same environment by name on dekka.internal, without going over the internet.
section: Networking
order: 2
---

Every service, database and Redis database has a private hostname in the form `<name>.<environment>.dekka.internal`, such as `api.production.dekka.internal`. Other services in the same environment use it to reach it without leaving Dekka's network, and nothing outside the environment can.

## Call another service privately

Use the other service's private hostname and the port it listens on. Dekka sets `DEKKA_PRIVATE_DOMAIN` on every service and `PORT` on web services, so a [reference](/docs/environment-variables#reference-another-services-variable) builds the address for you and keeps it current:

```bash title=".env"
API_INTERNAL_URL=http://${{api.DEKKA_PRIVATE_DOMAIN}}:${{api.PORT}}
```

Here `api` is the other service's name. The hostname uses the service's name, so renaming a service or its environment changes it from the next deploy, and Dekka updates references that point at a renamed service.

## Do I need private hostnames for databases?

No. A [connection](/docs/connections) gives your service a `DATABASE_URL` or `REDIS_URL` with the right host, so use that rather than building the address yourself.

## What can't use private networking?

Buckets have no private hostname and are reached through `S3_ENDPOINT`. Services in different environments or projects can't reach each other privately, which is what keeps `staging` away from `production` data.